Business Email Compromise (BEC) is one of the costliest email scams precisely because it doesn't need malware at all — just a well-timed, convincing message.

How BEC Typically Works

• Executive impersonation: An email that looks like it's from your CEO or a manager, asking for an urgent wire transfer or gift card purchase, often while claiming to be "in a meeting" and unreachable by phone.
• Vendor/invoice fraud: An email appearing to come from a real supplier, informing you their bank account details have "changed," redirecting your next payment to the attacker's account.
• Compromised account takeover: An attacker gains access to a real employee's or vendor's actual mailbox and inserts themselves into an existing, legitimate email thread, making the request very hard to distinguish from the real thing.

How to Prevent It

1. Verify payment or bank detail changes by phone, using a number you already have on file — never one provided in the email requesting the change.
2. Set a policy requiring a second person to approve any wire transfer, bank detail change, or gift card purchase over a set dollar amount, no exceptions for "urgent" requests.
3. Enable multi-factor authentication on every email account, so a stolen password alone isn't enough to take over a mailbox.
4. Set up SPF, DKIM, and DMARC for your domain to make it harder for attackers to spoof your company's email address directly (see our separate guide on this).
5. Train staff to spot urgency and secrecy cues — "don't tell anyone else about this yet" combined with financial urgency is a classic BEC pattern.

Common Questions

How is BEC different from regular phishing?

Regular phishing usually tries to steal credentials or install malware through a link or attachment. BEC skips that entirely — it's pure social engineering, asking a real person to willingly move money or information, which is why spam filters and antivirus alone don't catch it.

What should I do if I think we already fell for one?

Contact your bank immediately to attempt a wire recall, notify your IT/security team, and file a report with the FBI's Internet Crime Complaint Center (IC3) — the faster a wire transfer is reported, the better the odds of recovering funds.